Hi,
I have a universal forwarder that is monitoring a couple of text log files on a AD server. Now I would like to have the universal forwarder also monitor the windows event logs. So I currently have the following config in the input.conf;
[monitor://E:\App\serverlog.txt] disabled = false index=appserver
I have read through the manual and I am going to add:
[WinEventLog:Application] disabled = 0 [WinEventLog:Security] disabled = 0 [WinEventLog:System] disabled = 0 [WinEventLog:DNS Server] disabled = 0 [WinEventLog:Directory Service] disabled = 0 [WinEventLog:File Replication Service] disabled = 0
However I would like to have the logs from the AD in their own indexes and not all mixed up with the appserver index. I have installed the Splunk for AD addon.
Should I just add a index=adlog or something like that to the input.conf at the universal forwarder? Does the Splunk for AD split the logs to their own index automatically?
Hi krugger,
you just need to add to every stanza in your inputs.conf file the index you prefer.
So, taking your example:
[WinEventLog:Application]
disabled=0
index=adlog
This way, splunk will index that data undex adlog index. Also, I suggest to diversify your inputs assigning them different sourcetypes, specifying it in your inputs.conf under the "index" entry.
Regards,
Stefano
Hi krugger,
you just need to add to every stanza in your inputs.conf file the index you prefer.
So, taking your example:
[WinEventLog:Application]
disabled=0
index=adlog
This way, splunk will index that data undex adlog index. Also, I suggest to diversify your inputs assigning them different sourcetypes, specifying it in your inputs.conf under the "index" entry.
Regards,
Stefano
Do not forget to create the index on the indexer. Splunk will not create it for you automatically. Basic configuration of indexes can be done from the manager.
Also, you do not need to assign sourcetypes for windows event logs, as they will automatically get the source and sourcetype set to WinEventLog:XXXXX
for each value of XXXXX, in the monitor stanzas.
/k